ci(cd): sign images in deploy script

Author: kguzek

.github/workflows/cd.yml

@@ -1,27 +1,32 @@
-name: CD
+name: Continuous Deployment
 
 permissions:
   contents: read
+  id-token: write
 
 on:
   push:
     branches: ["main"]
+    tags: ["v*"]
   workflow_dispatch:
 
 jobs:
   deploy-to-registry:
     runs-on: ubuntu-latest
     environment: production
     steps:
+      - name: Checkout repository code
+        uses: actions/checkout@v6
+
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@v4.1.2
+
       - name: Login to container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ${{ vars.REGISTRY_HOSTNAME }}
           username: ${{ secrets.HARBOR_USERNAME }}
           password: ${{ secrets.HARBOR_PASSWORD }}
 
-      - name: Checkout repository code
-        uses: actions/checkout@v4
-
       - name: Run deploy script
         run: ./deploy.sh

deploy.sh

@@ -1,13 +1,11 @@
 #!/bin/bash
 
-NAMESPACE='liveseries'
+REGISTRY_HOSTNAME="${REGISTRY_HOSTNAME:-registry.guzek.uk}"
+PROJECT_NAME='liveseries'
 
 for dockerfile in ./Dockerfile.*; do
   repository=${dockerfile#./Dockerfile.}
-  tag="registry.guzek.uk/$NAMESPACE/$repository:latest"
-  # DOCKER_TOKEN=$(curl -s "https://auth.docker.io/token?service=registry.docker.io&scope=repository:$NAMESPACE/$repository:pull" | jq -r '.token')
-  # REMOTE_MANIFEST=$(curl -sH "Authorization: Bearer $DOCKER_TOKEN" "https://registry.hub.docker.com/v2/$NAMESPACE/$repository/manifests/latest" | jq -r .layers[0].digest)
-  # LOCAL_DIGEST=$(docker inspect --format='{{index .RepoDigests 0}}' "$tag" | cut -d '@' -f 2)
+  tag="$REGISTRY_HOSTNAME/$PROJECT_NAME/$repository:latest"
 
   echo "Building $repository..."
   build_output=$(docker build -t "$tag" -f "$dockerfile" . 2>&1)
@@ -19,6 +17,8 @@ for dockerfile in ./Dockerfile.*; do
   if [[ "$cached_steps" -lt "$total_steps" || $1 = "--force" ]]; then
     echo "Pushing image..."
     docker push "$tag"
+    digest=$(docker image inspect "$tag" --format '{{index .RepoDigests 0}}' | grep "^$REGISTRY_HOSTNAME/")
+    cosign sign --yes "$digest"
   else
     echo "Skipping push."
   fi